Commit d63c7dd5 authored Jan 06, 2016 by Insu Yun Committed by Martin K. Petersen Jan 07, 2016

ipr: Fix out-of-bounds null overwrite

Return value of snprintf is not bound by size value, 2nd argument.
(https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html

).
Return value is number of printed chars, can be larger than 2nd
argument.  Therefore, it can write null byte out of bounds ofbuffer.
Since snprintf puts null, it does not need to put additional null byte.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

parent 9055082f

drivers/scsi/ipr.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -4003,13 +4003,12 @@ static ssize_t ipr_store_update_fw(struct device *dev,
		struct ipr_sglist *sglist;
		char fname[100];
		char *src;
		int len, result, dnld_size;
		int result, dnld_size;

		if (!capable(CAP_SYS_ADMIN))
		return -EACCES;

		len = snprintf(fname, 99, "%s", buf);
		fname[len-1] = '\0';
		snprintf(fname, sizeof(fname), "%s", buf);

		if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
		dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);

Admin message